The sourcetype hypervisor:xenserver:sr isn't being populated correctly in one of the environments I need to work in.
In the inputs.conf of the TA, it shows that bin/getSR.py is populating this.
When manually running the script by the following from the app directory, it outputs some of the SR's then silently dies.
/opt/splunkforwarder/bin/splunk cmd /usr/bin/python bin/getSR.py
I found this was dying on:-
if(srRecord["shared"] and srRecord["other_config"]["XenCenter.CustomFields.vol_name"]):
out += " vol_name=%s" % (srRecord["other_config"]["XenCenter.CustomFields.vol_name"])
I changed the script to be :-
# added try/except to stop script failing after a couple of records
try:
if(srRecord["shared"] and srRecord["other_config"]["XenCenter.CustomFields.vol_name"]):
out += " vol_name=%s" % (srRecord["other_config"]["XenCenter.CustomFields.vol_name"])
except:
pass